令牌放在html里，被偷走怎么办？

直接问AI的话，回答是GPT3。。。。我试了很多分享出来的网页版，都回答是3. 而且似乎退步了，记得十几天前在官网回答比较详尽，现在连官网的回答都简短了？

what.md

please contact me i have some questions
+923357194808 my whatsapp
sir i need this script in english version can you please give me or do you have any video how can we create it and add to our website?
waiting for your reply and message

rvthub.com/:1 Access to XMLHttpRequest at 'https://cc-api.sbaliyun.com/' from origin 'https://rvthub.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.
(index):89 POST https://cc-api.sbaliyun.com/ net::ERR_FAILED

宝塔部署的，
clone: from https://github.com/sbaliyun/chatgpt-html.git
已经替换了有效的api key
xhr.setRequestHeader("Authorization", "Bearer 有效的api key");
运行之后，结果：正在思考，请等待...... 、
一直停留在这里，没有出结果。请问可能原因 是什么 ？

如图

请问是真是假？

功能请求，支持gpt-3.5-turbo model

API Reference - OpenAI 上有这个 API，但没有提到 ChatGPT，这个可能是普通的 GPT-3 的 API，而不是 ChatGPT 的。

可否让客户自己填写API。这样站长就无压力了。

Hi there,

I noticed that the client-side code you're using for your ChatGPT script exposes API keys and endpoints, which could pose a significant security risk. To prevent this, it's recommended to store sensitive data such as API keys in a .env file or as environment variables on the server-side, rather than displaying them publicly in client-side code.

In this particular case, the API keys and endpoints should be hidden using environment variables or by loading configuration files on the server-side. This can be achieved using server-side languages such as PHP or Node.js. The client-side code can then retrieve this information from a server endpoint, rather than directly accessing it.

Additionally, when using XMLHttpRequest and other Ajax methods, it's important to perform more thorough input validation and sanitization to protect against attacks such as XSS.

I hope this helps. If you have any further questions, please let me know.

Best regards,

Volkan Sah

Explanation:
The message highlights the potential security risks of exposing API keys and endpoints in client-side code, and recommends storing sensitive data in a more secure way. It also suggests using server-side languages to hide the API keys and endpoints, and performing input validation to protect against attacks such as XSS. The message concludes by offering further assistance if needed.